2

I want to verify phone number ownership with specially crafted and encrypted payload within an HTTP hyperlink callback through SMS as opposed to sending an SMS OTP code and writing it back in server web page. The payload will contain validity and expiry, random numbers, etc.

I wasn't able to find anyone using this or similar method except for advertising purposes.

Am I hitting some obvious vulnerability that I'm not aware of?

Improve this question
2
  • 3
    1) Not every phone is a smartphone that can open links. 2) Surely you meant HTTPS. 3) If an automated system starts sending me links that I must click on, I'll stop using it, even if it's my bank.
    – Marc
    Aug 21 '20 at 8:29
  • HTTPS for sure. It will be a single verify your phone number link message, only once.
    – Visar
    Aug 21 '20 at 15:51
2

Your proposal is to effectively use an SMS OTP code - but make it much longer than usual.

Your longer OTP code would be more resistant to brute force guessing, but there are better ways to counteract the problem of brute force attacks, for example:

  • Make the OTP code expire after a few minutes (and send the user a new one)
  • Invalidate the OTP code if the user types in the wrong code too many times (e.g. 3 times)
  • If the user account sees too many OTP input attempts, lock it out for a while

SMS OTP is now looked down upon because SMS has many security weaknesses. The SMS message could be intercepted by someone else (using a SIM swap attack, or some sort of interception while the message is in transit), and if that happens, the longer URL-based OTP code won't offer any additional security.

Usability is the final issue - some people won't want to open the link on their phone (e.g. if they are logging in on a computer). Their phone might not even have a working web browser, or connection to the internet. A short code that they can type in to any device is more convenient.

Improve this answer
1
  • + The browser may refuse to open an HTTP link. I would propose a deep link generated for the user upon the request as the optimal strategy. Needless to say that SMS is indeed a weak factor.
    – nethero
    Aug 21 '20 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.